EUDR Due Diligence System Requirements: What Operators Must Build

EUDR is not a deforestation-free certificate scheme — it is a due diligence obligation. There is no third-party audit that grants you a pass. Instead, operators must build a documented due diligence system, file a compliance statement via the EU's digital portal for every product shipment, and be able to demonstrate that the system was exercised effectively if an enforcement authority comes knocking.

Who must comply

EUDR creates obligations for two types of economic actors:

• Operators: Any company that places EUDR-relevant products on the EU market for the first time, or exports them from the EU. This includes manufacturers, importers, and EU-based traders who are the first to place the good on the EU market.
• Traders: Companies in the supply chain who are not the first placer. Large traders (over 250 employees, over €50M turnover) must exercise full due diligence. SME traders may use a simplified procedure — collecting and passing on the reference number from the operator's compliance statement.

The EUDR-relevant commodities are: cattle, cocoa, coffee, palm oil, soya, wood, rubber — and derived products. Use our free EUDR Applicability Checker to confirm whether your specific product falls within scope, and see our overview article EUDR 2026 — what the leather removal means for exporters for recent scope changes.

Pillar 1: Information collection

The information pillar requires operators to collect and maintain documented information about each EUDR-relevant product and its supply chain. Article 9 of the EUDR specifies the required data points:

• Description of the product (CN code, quantity, country of production)
• Geolocation coordinates of all plots of land where the commodity was produced
• Name, postal address, and email of the suppliers
• A statement that the product is deforestation-free
• Adequate and verifiable information that the product was produced in accordance with the relevant national legislation of the country of production

The geolocation requirement is the most technically challenging. For agricultural commodities: operators need latitude/longitude coordinates of each production plot. Plots under 4 hectares require a single GPS point; plots over 4 hectares require a polygon (boundary coordinates). The accuracy threshold is ±50 metres.

Pillar 2: Risk assessment

Once information is collected, operators must assess the risk that the product does not comply with EUDR — that is, the risk that it derives from deforested land (after 31 December 2020) or was produced illegally under national law. The risk assessment must consider:

1. Country/area classification: The Commission classifies countries as standard risk, low risk, or high risk. Products from low-risk countries benefit from simplified due diligence. High-risk country products trigger enhanced scrutiny and more checks at the border.
2. Presence of forests in the production area: Using the collected geolocation data cross-referenced with satellite forest monitoring data (such as Global Forest Watch).
3. Prevalence of deforestation or forest degradation in the country/area/commodity.
4. Compliance of the operator's suppliers with the EUDR.
5. Third-party verification or certifications (e.g. RSPO for palm oil, FSC for wood) — these can reduce but do not eliminate the risk assessment obligation.

Pillar 3: Risk mitigation

If the risk assessment identifies a non-negligible risk, operators must implement mitigation measures before placing the product on the EU market. Appropriate measures include:

• Requesting additional information, documentation, or independent verification from suppliers
• Conducting independent surveys or audits of the supply chain
• Supporting suppliers in building traceability systems and achieving geolocation coverage
• Diversifying supply to lower-risk sources while higher-risk sources are remediated

Only when the risk has been reduced to negligible may the operator file a compliance statement and place the product on the market.

Filing the due diligence statement

Before each placement on the EU market, operators must file a due diligence statement via the EU Compliance Information System (CIS). The CIS is the Commission's digital platform for EUDR statements. The filed statement generates a reference number that must accompany the product through the supply chain and be provided to any downstream trader.

Statements can be filed by the operator themselves or by an authorised representative. Third-party service providers — including EUDR compliance consultancies — can file on behalf of operators. Statements must be updated if new information changes the risk assessment for a product already placed on the market.

Penalties

Article 25 requires EU member states to impose effective, proportionate, and dissuasive penalties. The minimum penalty framework includes:

• Fines of at least 4% of the operator's total annual turnover in the EU in the preceding financial year — not just the value of the non-compliant goods.
• Confiscation of the non-compliant products and of any revenues derived from them.
• Temporary exclusion from public procurement processes.
• Temporary prohibition from placing further EUDR-relevant products on the EU market.

The 4% of EU turnover floor makes EUDR penalty exposure comparable to GDPR in terms of financial severity — a significant departure from previous deforestation-related rules where fines were typically tied to the value of the non-compliant shipment.